|
Symantec Scan Engine Multiple Vulnerabilities
|
|
Secunia Advisory:
|
SA19734
|
|
|
Release Date:
|
2006-04-24
|
|
Last Update:
|
2006-05-02
|
|
Popularity:
|
6,783 views
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
Security Bypass
Exposure of sensitive information
|
|
Where:
|
From local network
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Symantec Scan Engine 5.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2006-0230
CVE-2006-0231
CVE-2006-0232
|
|
Description:
Three vulnerabilities has been reported in Symantec Scan Engine, which can be exploited by malicious people to disclose potentially sensitive information, bypass authentication and conduct man-in-the-middle (MITM) attacks.
1) A design error in the authentication mechanism used by Symantec Scan Engine can be exploited to gain access to the web-based administrative interface via specially-crafted XML requests sent to the server using its proprietary protocol.
2) Symantec Scan Engine uses a static private DSA key for SSL communications between the server and the administrative control application. This key cannot be changed and can potentially be exploited in a man-in-the-middle attack to decrypt all communications between the Scan Engine and an administrative client.
3) Symantec Scan Engine does not properly restrict access to files within the installation directory. This can be exploited by unauthenticated users to download any file located under the directory, such as the configuration file, the scanning logs, and the current virus definitions via HTTP requests.
The vulnerabilities have been reported in version 5.0.
Solution:
Update to version 5.1.
Provided and/or discovered by:
1,2) Marc Bevand of Rapid7
3) Joe Testa of Rapid7
Changelog:
2006-05-02: Added link to US-CERT vulnerability note.
Original Advisory:
Symantec:
http://securityresponse.symantec.com/avcenter/security/Content/2006.04.21.html
Rapid7:
http://www.rapid7.com/advisories/R7-0021.html
http://www.rapid7.com/advisories/R7-0022.html
http://www.rapid7.com/advisories/R7-0023.html
Other References:
US-CERT VU#118388:
http://www.kb.cert.org/vuls/id/118388
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
